@estiva-app/ui 0.35.2 → 0.36.0

package/dist/gates/chunk-SYVKGOWM.js

@@ -0,0 +1,1131 @@
+#!/usr/bin/env node
+import {
+  repositoryOf
+} from "./chunk-YKZXKVR2.js";
+
+// src/gates/token-lint.ts
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import betterTailwindcss from "eslint-plugin-better-tailwindcss";
+import { getDefaultSelectors } from "eslint-plugin-better-tailwindcss/defaults";
+import { parser as typescriptParser, plugin as typescriptPlugin } from "typescript-eslint";
+
+// src/gates/token-style.ts
+var INLINE_STYLE_TOKEN_KEYS = /^(color|background|backgroundColor|backgroundImage|fill|stroke|fontSize|border|borderTop|borderRight|borderBottom|borderLeft|borderBlock|borderInline|borderStyle|boxShadow|textShadow)$|Color$/;
+var INLINE_STYLE_MESSAGE = "An inline style that sets a colour, a font size, a border or a shadow is outside the token contract: use a token class. If the value is computed (a palette, a size from a prop), say why in an eslint-disable comment. Width, height and transforms are fine.";
+var keyOf = (property) => {
+  if (property.computed) return void 0;
+  const key = property.key;
+  return key.type === "Identifier" ? key.name : key.type === "Literal" && typeof key.value === "string" ? key.value : void 0;
+};
+function constObject(name, scope) {
+  for (let current = scope; current; current = current.upper) {
+    const variable = current.set.get(name);
+    if (!variable) continue;
+    const definition = variable.defs[0];
+    if (variable.defs.length !== 1 || definition?.type !== "Variable" || definition.parent?.kind !== "const") return void 0;
+    let init = definition.node.init;
+    while (init && (init.type === "TSAsExpression" || init.type === "TSSatisfiesExpression")) init = init.expression;
+    return init?.type === "ObjectExpression" ? init : void 0;
+  }
+  return void 0;
+}
+var noTokenStyle = {
+  meta: {
+    type: "problem",
+    docs: { description: "No colour, font size, border or shadow in a style kept in a const" },
+    schema: [],
+    messages: { token: INLINE_STYLE_MESSAGE }
+  },
+  create(context) {
+    const reported = /* @__PURE__ */ new Set();
+    return {
+      JSXAttribute(ruleNode) {
+        const attribute = ruleNode;
+        if (attribute.name.name !== "style") return;
+        const value = attribute.value;
+        const expression = value?.type === "JSXExpressionContainer" ? value.expression : void 0;
+        if (expression?.type !== "Identifier") return;
+        const object = constObject(expression.name, context.sourceCode.getScope(ruleNode));
+        for (const property of object?.properties ?? []) {
+          if (property.type !== "Property" || reported.has(property)) continue;
+          const key = keyOf(property);
+          if (!key || !INLINE_STYLE_TOKEN_KEYS.test(key)) continue;
+          reported.add(property);
+          context.report({ node: property, messageId: "token" });
+        }
+      }
+    };
+  }
+};
+var tokenStylePlugin = { rules: { "no-token-style": noTokenStyle } };
+
+// src/gates/token-lint.ts
+var TOKEN_LINT_IGNORES = ["dist/", "storybook-static/", "node_modules/"];
+var KNOWN_PLUGINS = { "@typescript-eslint": typescriptPlugin };
+var CLASS_MAP_SELECTOR = {
+  kind: "variable",
+  name: "^(?:[A-Z][A-Z0-9_]*_(?:STYLES|CLASSES)|[a-z][a-zA-Z0-9]*(?:Styles|Classes))$",
+  match: [{ type: "strings" }, { type: "objectValues" }]
+};
+var WORDS = {
+  app: {
+    ramp: "Tailwind's type ramp is not a token. Use the ramp from the package: text-body-2, text-caption, text-h3, text-btn-default...",
+    palette: "Tailwind's palette is not a token. Use a colour from the package (bg-bg-surface, text-text-primary, border-border-subtle...); a colour with no token is a missing token.",
+    raw: "A raw colour is a missing token: add it to the package (tokens.css in every theme block, and the preset), or say why not in an eslint-disable comment.",
+    opacity: "An opacity modifier on a token colour compiles to nothing. A transparent colour is a token of its own (D16): add it to the package.",
+    type: "$0 is type written by hand. A token from the package sets the size, line height, letter spacing and weight together (text-body-2, text-caption, text-h5...); if none fits, add one to the package, or say why not in an eslint-disable comment.",
+    corner: "$0 is a corner written by hand, and no token has it. Use a corner from the package (rounded-sm 4px, rounded-md 6px, rounded-lg 8px...), or say why not in an eslint-disable comment.",
+    shadow: "$0 is a shadow written by hand. Use a shadow from the package (shadow-sm, shadow-md, shadow-focus-ring, drop-shadow-glow-success...); a shadow with no token is a missing token.",
+    merge: "Merge classes with the package's cn(), which the app re-exports. A plain tailwind-merge does not know the type ramp, and drops text-body-2 beside a text colour."
+  },
+  package: {
+    ramp: "Tailwind's type ramp is not a token. Use the ramp in tailwind-preset.js: text-body-2, text-caption, text-h3, text-btn-default...",
+    palette: "Tailwind's palette is not a token. Use a colour from tailwind-preset.js (bg-bg-surface, text-text-primary, border-border-subtle...); a colour with no token is a missing token.",
+    raw: "A raw colour is a missing token: add it to tokens.css in every theme block and to the preset, or say why not in an eslint-disable comment.",
+    opacity: "An opacity modifier on a token colour compiles to nothing. A transparent colour is a token of its own (D16): add it to tokens.css in every theme block and to the preset.",
+    type: "$0 is type written by hand. A token from tailwind-preset.js sets the size, line height, letter spacing and weight together (text-body-2, text-caption, text-h5...); if none fits, add one to the preset and to cn.ts, or say why not in an eslint-disable comment.",
+    corner: "$0 is a corner written by hand, and no token has it. Use a corner from tailwind-preset.js (rounded-sm 4px, rounded-md 6px, rounded-lg 8px...), or say why not in an eslint-disable comment.",
+    shadow: "$0 is a shadow written by hand. Use a shadow from tailwind-preset.js (shadow-sm, shadow-md, shadow-focus-ring, drop-shadow-glow-success...); a shadow with no token is a missing token.",
+    merge: "Merge classes with this package's cn() (src/cn.ts), the one place tailwind-merge is taught the type ramp. A plain tailwind-merge drops text-body-2 beside a text colour."
+  }
+};
+function tokenLint({ tailwindConfig = "tailwind.config.js", audience = "app" } = {}) {
+  const words = WORDS[audience];
+  return {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: typescriptParser,
+      parserOptions: { ecmaFeatures: { jsx: true } }
+    },
+    plugins: { "better-tailwindcss": betterTailwindcss },
+    settings: {
+      "better-tailwindcss": {
+        tailwindConfig,
+        selectors: [...getDefaultSelectors(), CLASS_MAP_SELECTOR]
+      }
+    },
+    rules: {
+      "better-tailwindcss/no-unknown-classes": "error",
+      "better-tailwindcss/no-restricted-classes": [
+        "error",
+        {
+          restrict: [
+            { pattern: "^(?:[a-z0-9-]+:)*text-(?:xs|sm|base|lg|xl|[2-9]xl)$", message: words.ramp },
+            {
+              pattern: "^(?:[a-z0-9-]+:)*(?:text|bg|border|ring|outline|fill|stroke|decoration|divide|placeholder|from|via|to|accent|caret|shadow)-(?:black|white|slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)(?:-[0-9]{2,3})?(?:/[0-9]{1,3})?$",
+              message: words.palette
+            },
+            { pattern: "^(?:[a-z0-9-]+:)*[a-z-]+-\\[[^\\]]*(?:#[0-9a-fA-F]{3}|rgba?\\(|hsla?\\(|oklch\\()", message: words.raw },
+            {
+              pattern: "^(?:[a-z0-9-]+:)*(?:text|bg|border|ring|outline|fill|stroke|decoration|divide|placeholder|from|via|to|accent|caret|shadow)-(?:bg|text|border|accent|info|warning|success|error)-[a-z-]+/[0-9]{1,3}$",
+              message: words.opacity
+            }
+          ]
+        }
+      ],
+      // UIG-21: "use the package's cn(), never a plain twMerge" was a sentence
+      // in all three repos' CLAUDE.md, and nothing checked it.
+      "no-restricted-imports": ["error", { paths: [{ name: "tailwind-merge", message: words.merge }] }]
+    }
+  };
+}
+var V = "^(?:(?:[^:\\[\\]\\s]|\\[[^\\]]*\\])+:)*!?";
+var NOT_COLOUR = "(?!color:|#|rgba?\\(|hsla?\\(|oklch\\(|var\\()";
+var HAND_WRITTEN = {
+  type: `${V}(?:text-\\[${NOT_COLOUR}|text-\\[length:|leading-\\[|tracking-\\[)[^\\]]+\\](?:/\\S*)?$`,
+  corner: `${V}rounded(?:-(?:t|r|b|l|s|e|tl|tr|br|bl|ss|se|es|ee))?-\\[[^\\]]+\\]$`,
+  shadow: `${V}(?:shadow|drop-shadow)-\\[(?!color:)[^\\]]+\\]$`,
+  spacing: `${V}-?(?:w|h|size|min-w|min-h|max-w|max-h|p[xytrblse]?|m[xytrblse]?|gap(?:-[xy])?|space-[xy]|inset(?:-[xy])?|top|right|bottom|left|translate-[xy]|basis|indent|scroll-[mp][xytrblse]?|border-spacing(?:-[xy])?)-\\[[^\\]]+\\]$`,
+  width: `${V}(?:border(?:-[xytrblse])?|divide-[xy]|outline|ring|ring-offset)-\\[(?:length:)?-?[0-9.]+(?:px|rem|em)?\\]$`
+};
+var INLINE_STYLE_TOKEN_PROPERTIES = String(INLINE_STYLE_TOKEN_KEYS);
+function loadPreset() {
+  const require2 = createRequire(import.meta.url);
+  const loadConfig = require2("tailwindcss/loadConfig");
+  return loadConfig(fileURLToPath(new URL("../../tailwind-preset.js", import.meta.url)));
+}
+function tokenValues({ audience = "app" } = {}) {
+  const words = WORDS[audience];
+  const preset = loadPreset();
+  const tokensBySize = {};
+  for (const [name, value] of Object.entries(preset.theme.extend.fontSize)) {
+    const size = Array.isArray(value) ? value[0] : value;
+    (tokensBySize[size] ??= []).push(`text-${name}`);
+  }
+  const cornersBySize = {};
+  for (const [name, size] of Object.entries(preset.theme.extend.borderRadius)) (cornersBySize[size] ??= []).push(name === "DEFAULT" ? "rounded" : `rounded-${name}`);
+  return {
+    files: ["**/*.{ts,tsx}"],
+    ignores: ["**/*.test.ts", "**/*.test.tsx"],
+    plugins: { "token-values": betterTailwindcss, "token-spacing": betterTailwindcss, "token-style": tokenStylePlugin },
+    rules: {
+      // A style kept in a const and passed by name (R9): the selector below cannot follow it.
+      "token-style/no-token-style": "error",
+      "token-values/no-restricted-classes": [
+        "error",
+        {
+          restrict: [
+            ...Object.entries(tokensBySize).map(([size, names]) => ({
+              pattern: `${V}text-\\[${size.replace(".", "\\.")}\\](?:/\\S*)?$`,
+              message: `$0 is the type ramp written by hand. Use ${names.join(" or ")}.`
+            })),
+            {
+              pattern: HAND_WRITTEN.type,
+              message: words.type
+            },
+            ...Object.entries(cornersBySize).map(([size, names]) => ({
+              pattern: `${V}rounded(?:-(?:t|r|b|l|s|e|tl|tr|br|bl|ss|se|es|ee))?-\\[${size.replace(".", "\\.")}\\]$`,
+              message: `$0 is a corner written by hand. Use ${names.join(" or ")} (with the same side, if it has one).`
+            })),
+            {
+              pattern: HAND_WRITTEN.corner,
+              message: words.corner
+            },
+            {
+              pattern: HAND_WRITTEN.shadow,
+              message: words.shadow
+            }
+          ]
+        }
+      ],
+      "token-spacing/no-restricted-classes": [
+        "warn",
+        {
+          restrict: [
+            {
+              pattern: HAND_WRITTEN.spacing,
+              message: "$0 is a size or a space written by hand. Use a step of the spacing scale (p-3, h-9, gap-2...) if one fits. Reported, not blocked."
+            },
+            {
+              pattern: HAND_WRITTEN.width,
+              message: "$0 is a border or ring width written by hand. Use border, border-2, ring-1... if one fits. Reported, not blocked."
+            }
+          ]
+        }
+      ],
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: `JSXAttribute[name.name="style"] > JSXExpressionContainer > ObjectExpression > Property[key.name=${INLINE_STYLE_TOKEN_PROPERTIES}]`,
+          message: INLINE_STYLE_MESSAGE
+        },
+        // The same key in quotes, `style={{ 'background': 'red' }}` (R9).
+        {
+          selector: `JSXAttribute[name.name="style"] > JSXExpressionContainer > ObjectExpression > Property[key.value=${INLINE_STYLE_TOKEN_PROPERTIES}]`,
+          message: INLINE_STYLE_MESSAGE
+        }
+      ]
+    }
+  };
+}
+function tokenConfig({ quiet = {}, ignores = [], ...options } = {}) {
+  return [
+    { ignores: [...TOKEN_LINT_IGNORES, ...ignores] },
+    {
+      plugins: { ...KNOWN_PLUGINS, ...quiet },
+      // Every other lint's directives are unused here, because their rules are
+      // off here. Reporting them would be this config complaining about the
+      // others' business.
+      linterOptions: { reportUnusedDisableDirectives: "off" }
+    },
+    tokenLint(options),
+    tokenValues({ audience: options.audience })
+  ];
+}
+
+// src/gates/ci.ts
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+var PROBE = '/** A probe CI writes to check the editor hook; never on disk. */\nexport function GateProbe() {\n  return <button type="button">x</button>\n}\n';
+var npm = (root, script) => spawnSync("npm", ["run", script], { cwd: root, stdio: "inherit", shell: true }).status === 0;
+function countCommitted(root) {
+  const run = spawnSync("git", ["status", "--porcelain", "--", ".gates-count.json"], { cwd: root, encoding: "utf8" });
+  if (run.status !== 0) return [`git could not read .gates-count.json's state: ${run.stderr.trim()}`];
+  if (!run.stdout.trim()) return [];
+  const diff = spawnSync("git", ["diff", "--", ".gates-count.json"], { cwd: root, encoding: "utf8" }).stdout.trim();
+  return [
+    "The gate found something other than the committed count: run `npm run lint:rules` and commit `.gates-count.json` with the change that moved it.",
+    ...diff ? diff.split("\n").filter((l) => /^[+-]\s/.test(l)).map((l) => `  ${l}`) : ["  .gates-count.json is not committed at all"]
+  ];
+}
+function hookRuns(root) {
+  const file = join(root, ".claude", "settings.json");
+  if (!existsSync(file)) return [".claude/settings.json is missing: the editor hook is not switched on (docs/GATES.md \xA723)."];
+  let entries;
+  try {
+    entries = JSON.parse(readFileSync(file, "utf8")).hooks?.PreToolUse ?? [];
+  } catch (error) {
+    return [`.claude/settings.json does not read as JSON: ${error instanceof Error ? error.message : String(error)}`];
+  }
+  const covers = (matcher, tool) => {
+    if (!matcher || matcher === "*") return true;
+    try {
+      return new RegExp(`^(?:${matcher})$`).test(tool);
+    } catch {
+      return false;
+    }
+  };
+  const input = JSON.stringify({ tool_name: "Write", session_id: "estiva-gates-ci", cwd: root, tool_input: { file_path: join(root, "src", "GateProbe.tsx"), content: PROBE } });
+  const tried = [];
+  for (const entry of entries) {
+    if (!covers(entry.matcher, "Write") || !covers(entry.matcher, "Edit")) continue;
+    for (const hook of entry.hooks ?? []) {
+      if (hook.type !== "command" || !hook.command) continue;
+      const command = hook.command.replace(/\$\{?CLAUDE_PROJECT_DIR\}?/g, root.split("\\").join("/"));
+      const run = spawnSync(command, { cwd: root, input, encoding: "utf8", shell: true, env: { ...process.env, CLAUDE_PROJECT_DIR: root }, timeout: 12e4 });
+      if (run.status === 2 && /UI Guardrails/.test(run.stderr)) return [];
+      tried.push(`  ${hook.command}  \u2192 exit ${run.status ?? "none"}${run.stderr.trim() ? `: ${run.stderr.trim().split("\n")[0]}` : ""}`);
+    }
+  }
+  return [
+    tried.length ? "The editor hook let a raw button through: no PreToolUse hook in .claude/settings.json refused it." : "No PreToolUse hook in .claude/settings.json runs before both Write and Edit: the editor gate is off.",
+    ...tried
+  ];
+}
+var plain = (glob) => glob.replace(/\/\*\*.*$|\/$/, "");
+async function skippedFolders(root) {
+  const found = /* @__PURE__ */ new Set();
+  for (const name of ["eslint.gates.config.js", "eslint.tokens.config.js"]) {
+    const file = join(root, name);
+    if (!existsSync(file)) continue;
+    const loaded = await import(`${pathToFileURL(file).href}?at=${statSync(file).mtimeMs}`);
+    const configs = [loaded.default].flat(Infinity);
+    for (const c of configs) {
+      if (!c || typeof c !== "object" || !Array.isArray(c.ignores) || Object.keys(c).some((k) => k !== "ignores" && k !== "name")) continue;
+      for (const glob of c.ignores) if (!TOKEN_LINT_IGNORES.includes(glob)) found.add(glob);
+    }
+  }
+  return [...found];
+}
+async function skipsListed(root, audience) {
+  const page = audience === "package" ? "docs/GATES.md" : "docs/GATES-DEBT.md";
+  const skipped = await skippedFolders(root);
+  if (!skipped.length) return [];
+  const text = existsSync(join(root, page)) ? readFileSync(join(root, page), "utf8") : "";
+  const missing = skipped.filter((glob) => !text.includes(plain(glob)));
+  if (!missing.length) return [];
+  return [`The gate skips folders ${page} does not name. Name each there, with why it is not checked (B11):`, ...missing.map((g) => `  ${g}`)];
+}
+async function runCi({ root = process.cwd(), audience = "app", print = (line) => process.stdout.write(`${line}
+`) } = {}) {
+  const scripts = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).scripts ?? {};
+  const tokens = scripts["lint:tokens"] ? "lint:tokens" : "lint";
+  const failed = [];
+  const step = async (title, run) => {
+    print(`
+\u25B8 ${title}`);
+    const result = await run();
+    const problems = result === true ? [] : result === false ? [`${title}: failed (above)`] : result;
+    if (problems.length) {
+      failed.push(title);
+      for (const line of problems) print(process.env.GITHUB_ACTIONS && !line.startsWith(" ") ? `::error::${line}` : line);
+    } else print("  \u2713");
+  };
+  await step("The gate lint (npm run lint:rules)", () => npm(root, "lint:rules"));
+  await step("The count is committed (.gates-count.json)", () => countCommitted(root));
+  await step(`The token contract (npm run ${tokens})`, () => npm(root, tokens));
+  await step("The catalogue (npm run registry:check)", () => npm(root, "registry:check"));
+  await step("The editor hook refuses a raw button (.claude/settings.json)", () => hookRuns(root));
+  await step("Every folder the gate skips is named on the debt page", () => skipsListed(root, audience));
+  print(failed.length ? `
+The gate failed: ${failed.join("; ")}.` : "\nThe gate passed.");
+  return failed.length ? 1 : 0;
+}
+
+// src/gates/count.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { join as join2, relative } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+import { APP_RULE_IDS, countGates, PACKAGE_RULE_IDS } from "../eslint/index.js";
+async function eslintFrom(root) {
+  const resolved = createRequire2(join2(root, "package.json")).resolve("eslint");
+  return (await import(pathToFileURL2(resolved).href)).ESLint;
+}
+async function writeGateCount({ root = process.cwd(), repo, audience = "app", config = "eslint.gates.config.js" }) {
+  const out = join2(root, ".gates-count.json");
+  const ESLint = await eslintFrom(root);
+  const eslint = new ESLint({
+    cwd: root,
+    overrideConfigFile: join2(root, config),
+    overrideConfig: { settings: { estiva: { reportEscapes: true } } }
+  });
+  const { rules, disabled } = countGates(await eslint.lintFiles(["."]), audience === "package" ? PACKAGE_RULE_IDS : APP_RULE_IDS);
+  const previous = existsSync2(out) ? JSON.parse(readFileSync2(out, "utf8")) : null;
+  const changed = JSON.stringify(previous?.rules) !== JSON.stringify(rules);
+  if (changed) {
+    const count = { schemaVersion: 1, repo, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), rules };
+    writeFileSync(out, `${JSON.stringify(count, null, 2)}
+`);
+  }
+  const lines = [changed ? ".gates-count.json: written" : ".gates-count.json: unchanged"];
+  for (const [id, c] of Object.entries(rules)) lines.push(`  ${id}: ${c.errors} errors, ${c.warnings} warnings, ${c.escapes} escapes`);
+  const failures = [];
+  if (disabled.length > 0) {
+    failures.push("", "An eslint-disable switched a gate rule off. Write the reason above the element instead, naming the rule: // @estiva-escape(<rule>): <reason>");
+    for (const d of disabled) failures.push(`  ${relative(root, d.filePath)}:${d.line}  ${d.ruleId}`);
+  }
+  return { rules, disabled, changed, lines, failures };
+}
+
+// src/gates/hook.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join as join3, relative as relative2, resolve, sep } from "node:path";
+import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL3 } from "node:url";
+import { countGates as countGates2 } from "../eslint/index.js";
+var TOKEN_RULE_IDS = new Set(tokenConfig().flatMap((c) => Object.keys(c.rules ?? {})));
+async function tokenErrors(ESLint, appDir, file, text, audience) {
+  const own = join3(appDir, "eslint.tokens.config.js");
+  const eslint = existsSync3(own) ? new ESLint({ cwd: appDir, overrideConfigFile: own }) : new ESLint({ cwd: appDir, overrideConfigFile: true, overrideConfig: tokenConfig({ audience }) });
+  const results = await eslint.lintText(text, { filePath: file });
+  return results.flatMap((r) => r.messages.filter((m) => m.severity === 2 && m.ruleId && TOKEN_RULE_IDS.has(m.ruleId)));
+}
+var PASS = { code: 0, message: "" };
+var APP_SOURCE = /^src\/.+\.[cm]?[jt]sx?$/;
+async function runHook({ root, app = ".", audience = "app", input, seen } = {}) {
+  let call;
+  try {
+    call = input ?? JSON.parse(readFileSync3(0, "utf8"));
+  } catch {
+    return PASS;
+  }
+  const args = call.tool_input ?? {};
+  if (typeof args.file_path !== "string") return PASS;
+  const top = root ?? process.env.CLAUDE_PROJECT_DIR ?? call.cwd ?? process.cwd();
+  const appDir = resolve(top, app);
+  const file = isAbsolute(args.file_path) ? args.file_path : resolve(call.cwd ?? top, args.file_path);
+  const rel = relative2(appDir, file).split(sep).join("/");
+  const source = audience === "package" ? /^src\/.+\.tsx$/ : APP_SOURCE;
+  if (rel.startsWith("../") || isAbsolute(rel) || !source.test(rel) || /\.test\.[cm]?[jt]sx?$/.test(rel) || /\.d\.[cm]?ts$/.test(rel)) return PASS;
+  const text = proposed(call.tool_name, args, file);
+  if (text === null) return PASS;
+  const resolved = createRequire3(join3(appDir, "package.json")).resolve("eslint");
+  const { ESLint } = await import(pathToFileURL3(resolved).href);
+  const config = join3(appDir, "eslint.gates.config.js");
+  const eslint = new ESLint({ cwd: appDir, overrideConfigFile: config });
+  const results = await eslint.lintText(text, { filePath: file });
+  const errors = results.flatMap((r) => r.messages.filter((m) => m.severity === 2 && m.ruleId));
+  errors.push(...await tokenErrors(ESLint, appDir, file, text, audience));
+  const { disabled } = countGates2(results);
+  if (errors.length === 0 && disabled.length === 0) {
+    const stopped = searchFirst(call, file, text, appDir, top, seen);
+    if (stopped) return stopped;
+    const copies = results.flatMap((r) => r.messages.filter((m) => m.severity === 1 && m.ruleId === "estiva/no-copied-look"));
+    return copies.length ? { code: 0, message: "", note: copies.map((m) => `${relative2(top, file).split(sep).join("/")}:${m.line}  ${m.message}`).join("\n") } : PASS;
+  }
+  const shown = (p) => relative2(top, p).split(sep).join("/");
+  const lines = [`${shown(file)} was not written: the UI Guardrails refuse it (${shown(config)}).`];
+  for (const m of errors) lines.push(`  ${m.line}:${m.column}  ${m.message}${m.ruleId ? `  (${m.ruleId})` : ""}`);
+  const keep = audience === "package" ? "Keep it only" : "Keep the element only";
+  for (const d of disabled) lines.push(`  ${d.line}  an eslint-disable switches ${d.ruleId} off. ${keep} with its reason on the line above: // @estiva-escape(${d.ruleId.slice(d.ruleId.lastIndexOf("/") + 1)}): <reason>`);
+  return { code: 2, message: `${lines.join("\n")}
+` };
+}
+function newPart(tool, file, text) {
+  if (tool !== "Write" || existsSync3(file) || !file.endsWith(".tsx") || /\.stories\.tsx$/.test(file)) return null;
+  if (!/<\/[A-Za-z]|\/>/.test(text)) return null;
+  const named = /export\s+(?:default\s+)?(?:async\s+)?(?:function|const|class)\s+([A-Z][A-Za-z0-9]*)/.exec(text)?.[1];
+  if (named) return named;
+  return /export\s+default\s+function\s*\(/.test(text) ? basename(file, ".tsx") : null;
+}
+var wordsOf = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2").toLowerCase();
+function findCommand() {
+  for (const at of ["../registry/cli.js", "../../dist/registry/cli.js"]) {
+    const path = fileURLToPath2(new URL(at, import.meta.url));
+    if (existsSync3(path)) return path;
+  }
+  return null;
+}
+function searchFirst(call, file, text, appDir, top, seen) {
+  const part = newPart(call.tool_name, file, text);
+  const command = findCommand();
+  if (!part || !command) return null;
+  const folder = seen ?? join3(tmpdir(), "estiva-ui-search-first");
+  const mark = join3(folder, createHash("sha1").update(`${call.session_id ?? ""}
+${resolve(file)}`).digest("hex"));
+  if (existsSync3(mark)) return null;
+  const words = wordsOf(part);
+  const repo = basename(repositoryOf(appDir));
+  const run = spawnSync2(process.execPath, [command, "find", ...words.split(" "), "--root", appDir, "--repo", repo, "--limit", "5"], { encoding: "utf8", timeout: 6e4 });
+  if (run.status !== 0 || !run.stdout.trim()) return null;
+  try {
+    mkdirSync(folder, { recursive: true });
+    writeFileSync2(mark, "");
+  } catch {
+    return null;
+  }
+  const shown = relative2(top, file).split(sep).join("/");
+  return {
+    code: 2,
+    message: `${shown} was not written yet: it adds a new part, ${part}. Search before building (UIG-20). What already exists for "${words}":
+
+${run.stdout.trim()}
+
+If one of these does the job, use it, and read its page first. If the words were wrong, run \`npm run ui:find <other words>\`. If nothing fits, tell the person, then write the file again: it goes through.
+`
+  };
+}
+function proposed(tool, args, file) {
+  if (tool === "Write") return typeof args.content === "string" ? args.content : null;
+  if (tool !== "Edit" || typeof args.old_string !== "string" || typeof args.new_string !== "string") return null;
+  const { old_string: from, new_string: to } = args;
+  const current = existsSync3(file) ? readFileSync3(file, "utf8") : "";
+  for (const text of [current, current.replace(/\r\n/g, "\n")]) {
+    if (!text.includes(from)) continue;
+    return args.replace_all === true ? text.split(from).join(to) : text.replace(from, () => to);
+  }
+  return null;
+}
+
+// src/gates/name-escapes.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { createRequire as createRequire4 } from "node:module";
+import { join as join4, relative as relative3 } from "node:path";
+import { pathToFileURL as pathToFileURL4 } from "node:url";
+var UNNAMED = /@estiva-escape(?!\s*\()/;
+var NAMED_IN_MESSAGE = /@estiva-escape\(([^)]+)\)/;
+async function nameEscapes({ root = process.cwd(), config = "eslint.gates.config.js" } = {}) {
+  const resolved = createRequire4(join4(root, "package.json")).resolve("eslint");
+  const { ESLint } = await import(pathToFileURL4(resolved).href);
+  const eslint = new ESLint({ cwd: root, overrideConfigFile: join4(root, config) });
+  const results = await eslint.lintFiles(["."]);
+  const named = [];
+  const unreached = [];
+  for (const result of results) {
+    const byLine = /* @__PURE__ */ new Map();
+    for (const m of result.messages) {
+      if (m.messageId !== "escapeWithoutRule") continue;
+      const rule = NAMED_IN_MESSAGE.exec(m.message)?.[1];
+      if (!rule) continue;
+      byLine.set(m.line, (byLine.get(m.line) ?? /* @__PURE__ */ new Set()).add(rule));
+    }
+    const source = result.source ?? readFileSync4(result.filePath, "utf8");
+    const eol = source.includes("\r\n") ? "\r\n" : "\n";
+    const lines = source.split(/\r?\n/);
+    let changed = false;
+    const file = relative3(root, result.filePath).split("\\").join("/");
+    for (const [line, rules] of byLine) {
+      for (let i = line - 1; i < Math.min(lines.length, line + 3); i++) {
+        if (!UNNAMED.test(lines[i])) continue;
+        const names = [...rules].sort().join(", ");
+        lines[i] = lines[i].replace(UNNAMED, `@estiva-escape(${names})`);
+        named.push(`${file}:${i + 1}  ${names}`);
+        changed = true;
+        break;
+      }
+    }
+    if (changed) writeFileSync3(result.filePath, lines.join(eol), "utf8");
+    lines.forEach((text, i) => {
+      if (UNNAMED.test(text) && !/eslint-disable/.test(text) && /\/\/|\/\*/.test(text)) unreached.push(`${file}:${i + 1}`);
+    });
+  }
+  return { named, unreached };
+}
+
+// src/gates/escapes.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { join as join5, relative as relative4 } from "node:path";
+
+// src/eslint/escape.ts
+var ESCAPE_MARKER = "@estiva-escape";
+var MIN_REASON = 10;
+var ESCAPE_MESSAGES = {
+  escapeWithoutReason: `An escape needs its reason, at least ${MIN_REASON} characters: \`// ${ESCAPE_MARKER}({{rule}}): <why this stays>\`. An escape with no reason hides nothing.`,
+  escapeInDirective: `Write the escape as its own comment on the line above: \`// ${ESCAPE_MARKER}({{rule}}): <reason>\`. Inside an eslint-disable comment it switches the rule off instead of recording why.`,
+  escapeWithoutRule: `Name the rule this escape keeps off: \`${ESCAPE_MARKER}({{rule}}): <reason>\`. An escape now keeps off only the rules it names.`,
+  escaped: "Escaped: {{reason}}"
+};
+var shortRuleName = (id) => id.slice(id.lastIndexOf("/") + 1);
+function readMarker(text) {
+  const at = text.indexOf(ESCAPE_MARKER);
+  if (at === -1) return null;
+  const rest = text.slice(at + ESCAPE_MARKER.length);
+  const named = /^\s*\(([^)]*)\)/.exec(rest);
+  const rules = named ? named[1].split(/[\s,]+/).filter(Boolean).map(shortRuleName) : [];
+  const reason = (named ? rest.slice(named[0].length) : rest).replace(/^\s*:/, "").trim();
+  return { rules, reason };
+}
+
+// src/gates/escapes.ts
+var REVIEW_AFTER_DAYS = 30;
+var SOURCE = /\.[cm]?[jt]sx?$/;
+var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git", "storybook-static", "coverage"]);
+var DIRECTIVE = /eslint-disable(?:-next-line|-line)?\s+(.*?)\s+--\s+@estiva-escape\s*:?\s*(.*)$/;
+function sourceFiles(dir, out = []) {
+  if (!existsSync4(dir)) return out;
+  for (const name of readdirSync(dir)) {
+    if (SKIP.has(name)) continue;
+    const path = join5(dir, name);
+    if (statSync2(path).isDirectory()) sourceFiles(path, out);
+    else if (SOURCE.test(name) && !/\.test\.[cm]?[jt]sx?$/.test(name)) out.push(path);
+  }
+  return out;
+}
+function lineTimes(root, file) {
+  const times = /* @__PURE__ */ new Map();
+  try {
+    const out = execFileSync("git", ["blame", "--line-porcelain", "--", relative4(root, file)], { cwd: root, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 << 20 }).toString();
+    let line = 0;
+    for (const row of out.split("\n")) {
+      const header = /^[0-9a-f]{40} \d+ (\d+)/.exec(row);
+      if (header) line = Number(header[1]);
+      else if (row.startsWith("author-time ")) times.set(line, Number(row.slice(12)));
+    }
+  } catch {
+  }
+  return times;
+}
+function listEscapes(root, { folders = ["src"], now = Date.now() } = {}) {
+  const found = [];
+  for (const file of folders.flatMap((f) => sourceFiles(join5(root, f)))) {
+    const lines = readFileSync5(file, "utf8").split(/\r?\n/);
+    const hits = [];
+    lines.forEach((text, i) => {
+      if (!text.includes("@estiva-escape")) return;
+      const rel = relative4(root, file).split("\\").join("/");
+      if (/<(reason|why|rule)\b/.test(text)) return;
+      const directive = /^\s*(?:\/\/|\{?\/\*)\s*eslint-disable/.test(text) ? DIRECTIVE.exec(text) : null;
+      if (directive) {
+        hits.push({ file: rel, line: i + 1, rules: directive[1].split(/[\s,]+/).filter(Boolean), reason: directive[2].replace(/\*\/\s*}?\s*$/, "").trim(), kind: "token" });
+        return;
+      }
+      if (!/^\s*(?:\/\/+|\{?\/\*+)?\s*@estiva-escape(?:\s*\(|\s*:)/.test(text)) return;
+      const marker = readMarker(text);
+      if (!marker) return;
+      hits.push({ file: rel, line: i + 1, rules: marker.rules, reason: marker.reason.replace(/\*\/\s*}?\s*$/, "").trim(), kind: "gate" });
+    });
+    if (!hits.length) continue;
+    const times = lineTimes(root, file);
+    for (const hit of hits) {
+      const at = times.get(hit.line);
+      found.push({ ...hit, days: at === void 0 ? null : Math.floor((now - at * 1e3) / 864e5) });
+    }
+  }
+  return found.sort((a, b) => (b.days ?? -1) - (a.days ?? -1) || a.file.localeCompare(b.file) || a.line - b.line);
+}
+function escapeLines(escapes, { all = false } = {}) {
+  const due = escapes.filter((e) => (e.days ?? 0) > REVIEW_AFTER_DAYS);
+  const shown = all ? escapes : due;
+  const gate = escapes.filter((e) => e.kind === "gate").length;
+  const out = [`Escapes: ${escapes.length} (${gate} of the gate's, ${escapes.length - gate} of the token lint's) \xB7 ${due.length} older than ${REVIEW_AFTER_DAYS} days, to review: keep with a new reason, or fix${all ? "" : " \xB7 every escape: add -- --escapes"}`];
+  for (const e of shown) out.push(`  ${e.file}:${e.line}  ${e.rules.join(", ") || "(no rule named)"} \xB7 ${e.days === null ? "not in git yet" : `${e.days} days`}
+      ${e.reason}`);
+  return out;
+}
+
+// src/gates/status.ts
+import { execFileSync as execFileSync2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync3 } from "node:fs";
+import { createRequire as createRequire5 } from "node:module";
+import { join as join6, relative as relative5, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL5 } from "node:url";
+var { version } = createRequire5(import.meta.url)("../../package.json");
+var ENGINE = `@estiva-app/ui@${version}`;
+var PASS2 = (detail) => ({ result: "pass", detail });
+var FAIL = (detail) => ({ result: "fail", detail });
+var PART = (detail) => ({ result: "part", detail });
+var UNKNOWN = (detail) => ({ result: "unknown", detail });
+var said = (e) => {
+  const err = e;
+  return { text: `${err.stdout ?? ""}${err.stderr ?? ""}`, message: String(err.message ?? e), code: err.code };
+};
+var GATE_CI_SCRIPTS = /* @__PURE__ */ new Set(["lint:rules", "lint:tokens", "lint", "registry:check"]);
+function runsGateCi(text, script) {
+  if (typeof script !== "string" || !GATE_CI_SCRIPTS.has(script)) return null;
+  const m = /^(?!\s*#).*?((?:npx )?estiva-gates ci\b|npm run gates:ci\b|cli\.js"? ci\b)/m.exec(text);
+  return m ? m[1] : null;
+}
+function helpers(ROOT) {
+  const abs = (rel) => resolve2(ROOT, rel);
+  const exists = (rel) => existsSync5(abs(rel));
+  const read = (rel) => readFileSync6(abs(rel), "utf8");
+  const git = (...a) => {
+    try {
+      return execFileSync2("git", a, { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  const listFiles = (rel, test) => {
+    const out = [];
+    const walk = (dir) => {
+      if (!existsSync5(dir)) return;
+      for (const name of readdirSync2(dir)) {
+        if (["node_modules", ".git", "dist", "storybook-static", ".verify-shots"].includes(name)) continue;
+        const p = join6(dir, name);
+        if (statSync3(p).isDirectory()) walk(p);
+        else if (test(name, p)) out.push(relative5(ROOT, p).replace(/\\/g, "/"));
+      }
+    };
+    walk(abs(rel));
+    return out;
+  };
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return {
+    PASS: PASS2,
+    FAIL,
+    PART,
+    UNKNOWN,
+    exists,
+    read,
+    listFiles,
+    // The registry bundle's own builder, loaded only when a check asks for it:
+    // it reads TypeScript with TypeScript, which the other checks never need.
+    async catalogue(appDir) {
+      try {
+        const { buildAppRegistry, validateRegistry } = await import("../registry/index.js");
+        const registry = buildAppRegistry({ root: abs(appDir) });
+        const problems = validateRegistry(registry);
+        if (problems.length) return FAIL(`${problems.length} problems, the first: ${problems[0]}`);
+        return PASS2(`${registry.entries.length} parts in ${registry.builtFrom.files} files, each described and sorted`);
+      } catch (error) {
+        const lines = String(error instanceof Error ? error.message : error).split("\n");
+        return FAIL(lines.length > 1 ? `${lines.length - 1} problems, the first: ${lines[1].trim()}` : lines[0]);
+      }
+    },
+    async contract(appDir) {
+      try {
+        const { buildAppRegistry, contractProblems, CONTRACT_KINDS } = await import("../registry/index.js");
+        const registry = buildAppRegistry({ root: abs(appDir) });
+        const problems = contractProblems(registry, abs(appDir));
+        const owed = registry.entries.filter((entry) => CONTRACT_KINDS.includes(entry.app?.class ?? "")).length;
+        if (problems.length) return FAIL(`${problems.length} of ${owed}; the first: ${problems[0]}`);
+        return PASS2(`all ${owed} reusable parts keep the usage-page contract and are drawn somewhere`);
+      } catch (error) {
+        return FAIL(String(error instanceof Error ? error.message : error).split("\n")[0]);
+      }
+    },
+    instructions(limit = 200) {
+      if (!exists("CLAUDE.md")) return FAIL("there is no CLAUDE.md");
+      const lines = (rel) => read(rel).replace(/\r?\n$/, "").split(/\r?\n/).length;
+      const imports = [...read("CLAUDE.md").matchAll(/^@(\S+)\s*$/gm)].map((m) => m[1]);
+      const missing = imports.filter((rel) => !exists(rel));
+      if (missing.length) return FAIL(`CLAUDE.md imports ${missing.join(", ")}, which is not there`);
+      const total = imports.reduce((n, rel) => n + lines(rel), lines("CLAUDE.md"));
+      const what = imports.length ? `CLAUDE.md with ${imports.join(", ")}` : "CLAUDE.md";
+      if (total >= limit) return FAIL(`${what}: ${total} lines load into every session; the limit is ${limit}`);
+      const rules = listFiles(".claude/rules", (n) => n.endsWith(".md"));
+      const unscoped = rules.filter((rel) => {
+        const front = /^---\r?\n([\s\S]*?)\r?\n---/.exec(read(rel));
+        return !front || !/^paths:/m.test(front[1]);
+      });
+      if (unscoped.length) return FAIL(`${unscoped.join(", ")} has no paths:, so it loads into every session`);
+      return PASS2(`${what}: ${total} lines in every session; ${rules.length ? `${rules.length} rule files, each loading only for its paths` : "no rule files"}`);
+    },
+    file(rel) {
+      return exists(rel) ? PASS2(`${rel} exists`) : FAIL(`${rel} does not exist`);
+    },
+    committed(rel) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      return git("ls-files", "--error-unmatch", rel) ? PASS2(`${rel} is committed`) : FAIL(`${rel} exists but is not committed`);
+    },
+    contains(rel, needle, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      const hit = typeof needle === "string" ? read(rel).includes(needle) : needle.test(read(rel));
+      return hit ? PASS2(label ?? `${rel} has ${needle}`) : FAIL(label ? `not yet: ${label}` : `${rel} has no ${needle}`);
+    },
+    lacks(rel, needle, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      const hit = typeof needle === "string" ? read(rel).includes(needle) : needle.test(read(rel));
+      return hit ? FAIL(`${rel} still has ${needle}`) : PASS2(label ?? `${rel} has no ${needle}`);
+    },
+    script(pkgRel, name) {
+      if (!exists(pkgRel)) return FAIL(`${pkgRel} does not exist`);
+      const cmd = JSON.parse(read(pkgRel)).scripts?.[name];
+      return cmd ? PASS2(`${pkgRel} runs "${name}": ${cmd}`) : FAIL(`${pkgRel} has no "${name}" script`);
+    },
+    async loads(rel) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      try {
+        const mod = await import(pathToFileURL5(abs(rel)).href);
+        return mod.default ? PASS2(`${rel} loads`) : FAIL(`${rel} has no default export`);
+      } catch (e) {
+        return FAIL(`${rel} does not load: ${said(e).message.split("\n")[0]}`);
+      }
+    },
+    /** A workflow step that runs `npm run <script>`; a regex matches the script name. */
+    ci(script) {
+      const files = listFiles(".github/workflows", (n) => /\.ya?ml$/.test(n));
+      const name = typeof script === "string" ? escape(script) : script.source;
+      const step = new RegExp(`npm run (${name})(?![\\w:-])`);
+      for (const f of files) {
+        const m = read(f).match(step);
+        if (m) return PASS2(`${f} runs npm run ${m[1]}`);
+        const all = runsGateCi(read(f), script);
+        if (all) return PASS2(`${f} runs ${all}, which runs npm run ${script}`);
+      }
+      return FAIL(`no workflow runs npm run ${script}`);
+    },
+    /**
+     * A workflow job, by its id, with a step that runs `npm run <script>`. Branch
+     * protection requires a whole job by its name, so a required check needs the
+     * job, not the step somewhere (UIG-6). A job is a key two spaces in under
+     * `jobs:`, and ends at the next line that is not indented further; a comment
+     * line does not count.
+     */
+    ciJob(job, script) {
+      const files = listFiles(".github/workflows", (n) => /\.ya?ml$/.test(n));
+      const header = new RegExp(`^  ${escape(job)}:\\s*(#.*)?$`);
+      const step = new RegExp(`^(?!\\s*#).*npm run ${escape(script)}(?![\\w:-])`, "m");
+      for (const f of files) {
+        const lines = read(f).split(/\r?\n/);
+        const from = lines.findIndex((l) => /^jobs:\s*$/.test(l));
+        const start = from === -1 ? -1 : lines.findIndex((l, i) => i > from && header.test(l));
+        if (start === -1) continue;
+        const end = lines.findIndex((l, i) => i > start && /^ {0,2}\S/.test(l));
+        const body = lines.slice(start + 1, end === -1 ? void 0 : end).join("\n");
+        if (step.test(body)) return PASS2(`${f}: the job ${job} runs npm run ${script}`);
+        const all = runsGateCi(body, script);
+        return all ? PASS2(`${f}: the job ${job} runs ${all}, which runs npm run ${script}`) : FAIL(`${f}: the job ${job} does not run npm run ${script}`);
+      }
+      return FAIL(`no workflow has a job ${job}`);
+    },
+    hook(settingsRel, needle) {
+      if (!exists(settingsRel)) return FAIL(`${settingsRel} does not exist`);
+      let s;
+      try {
+        s = JSON.parse(read(settingsRel));
+      } catch {
+        return FAIL(`${settingsRel} is not valid JSON`);
+      }
+      const entries = (s.hooks?.PreToolUse ?? []).flatMap((m) => (m.hooks ?? []).map((x) => ({ matcher: m.matcher ?? "", command: x.command ?? "" })));
+      const hit = entries.find((e) => e.command.includes(needle));
+      if (!hit) return FAIL(entries.length ? `${settingsRel} has PreToolUse hooks, none running ${needle}` : `${settingsRel} has no PreToolUse hook`);
+      let matches;
+      try {
+        matches = hit.matcher === "" || hit.matcher === "*" || new RegExp(`^(?:${hit.matcher})$`).test("Write");
+      } catch {
+        return FAIL(`${settingsRel}: the hook's matcher "${hit.matcher}" is not a pattern`);
+      }
+      if (!matches) return FAIL(`${settingsRel}: the hook runs only for "${hit.matcher}", never for a Write`);
+      const top = ROOT.split("\\").join("/");
+      const app = /--app\s+("?)([^"\s]+)\1/.exec(hit.command)?.[2] ?? ".";
+      const input = JSON.stringify({
+        hook_event_name: "PreToolUse",
+        cwd: top,
+        tool_name: "Write",
+        tool_input: { file_path: `${resolve2(ROOT, app, "src", "__gates_hook_probe__.tsx").split("\\").join("/")}`, content: 'export function Probe() {\n  return <div><button type="button">x</button></div>\n}\n' }
+      });
+      const command = hit.command.replace(/\$\{?CLAUDE_PROJECT_DIR\}?/g, top);
+      const run = spawnSync3(command, { cwd: ROOT, input, shell: true, encoding: "utf8", timeout: 12e4, env: { ...process.env, CLAUDE_PROJECT_DIR: top } });
+      if (run.status === 2 && /<button>/.test(`${run.stderr ?? ""}${run.stdout ?? ""}`)) return PASS2(`${settingsRel}: the hook ran and refused a raw <button> (exit 2)`);
+      const why = `${run.stderr ?? ""}${run.stdout ?? ""}`.trim().split(/\r?\n/)[0] || (run.error ? String(run.error.message) : "no output");
+      return FAIL(`${settingsRel}: the hook ran and let a raw <button> through (exit ${run.status ?? "none"}): ${why}`);
+    },
+    json(rel, test = () => true, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      let data;
+      try {
+        data = JSON.parse(read(rel));
+      } catch {
+        return FAIL(`${rel} is not valid JSON`);
+      }
+      if (!git("ls-files", "--error-unmatch", rel)) return FAIL(`${rel} is not committed`);
+      return test(data) ? PASS2(label ?? `${rel} is committed and parses`) : FAIL(`${rel} parses, but ${label ?? "fails its test"}`);
+    },
+    /** Lints a line of code that is never written to disk, the way the hook will. */
+    async lint({ cwd = ".", config, file, code, expect, mentions }) {
+      const cfg = join6(cwd, config);
+      if (!exists(cfg)) return FAIL(`${cfg} does not exist`);
+      let ESLint;
+      try {
+        const req = createRequire5(join6(abs(cwd), "package.json"));
+        ({ ESLint } = await import(pathToFileURL5(req.resolve("eslint")).href));
+      } catch (e) {
+        return UNKNOWN(`could not load eslint from ${cwd}: ${said(e).message.split("\n")[0]}`);
+      }
+      let results;
+      try {
+        const eslint = new ESLint({ cwd: abs(cwd), overrideConfigFile: config });
+        results = await eslint.lintText(code, { filePath: join6(abs(cwd), file), warnIgnored: true });
+      } catch (e) {
+        return UNKNOWN(`${cfg} could not lint ${file}: ${said(e).message.split("\n")[0]}`);
+      }
+      const messages = results.flatMap((r) => r.messages);
+      const ignored = messages.some((m) => /ignored/i.test(m.message) && !m.ruleId);
+      const fatal = messages.find((m) => m.fatal && !/ignored/i.test(m.message));
+      if (fatal) return UNKNOWN(`${file} did not parse: ${fatal.message}`);
+      const want = expect === "error" ? 2 : expect === "warning" ? 1 : 0;
+      if (want === 0) {
+        const any = messages.filter((m) => m.ruleId && m.severity === 2);
+        return any.length ? FAIL(`${file} gets an error it should not: ${any[0].message}`) : PASS2(`${file}: no error${ignored ? " (not linted)" : ""}`);
+      }
+      if (ignored) return FAIL(`${cfg} does not lint ${file}`);
+      const hit = messages.find((m) => m.ruleId && m.severity === want && (!mentions || m.message.includes(mentions)));
+      const kind = want === 2 ? "error" : "warning";
+      return hit ? PASS2(`${file} gets ${want === 2 ? "an" : "a"} ${kind}: ${hit.message}`) : FAIL(`${file} gets no ${kind}${mentions ? ` naming ${mentions}` : ""}`);
+    },
+    /**
+     * A GitHub setting, not a file, so it is asked of GitHub: the checks a merge
+     * into the default branch must pass, from the rulesets in force on it
+     * (`rules/branches/<branch>`, which anyone who can read the repository may
+     * see) and from classic protection as `branches/<branch>` reports it. Not
+     * `branches/<branch>/protection`: GitHub answers "Not Found" there to anyone
+     * who is not an admin, and it knows nothing of rulesets (UIG-6).
+     */
+    protectedBranch(pattern) {
+      const url = git("remote", "get-url", "origin");
+      const slug = url?.match(/github\.com[:/](.+?)(?:\.git)?$/)?.[1];
+      if (!slug) return UNKNOWN("no GitHub remote");
+      const branch = (git("symbolic-ref", "--short", "refs/remotes/origin/HEAD") ?? "origin/main").replace(/^origin\//, "");
+      const ask = (path) => JSON.parse(execFileSync2("gh", ["api", path], { stdio: ["ignore", "pipe", "pipe"], timeout: 2e4 }).toString());
+      let rules;
+      let classic;
+      try {
+        rules = ask(`repos/${slug}/rules/branches/${branch}`);
+        classic = ask(`repos/${slug}/branches/${branch}`).protection?.required_status_checks;
+      } catch (e) {
+        const s = said(e);
+        return UNKNOWN(`could not ask GitHub (${s.code === "ENOENT" ? "gh is not installed" : s.text.split("\n")[0] || s.message})`);
+      }
+      const names = [
+        ...rules.filter((r) => r.type === "required_status_checks").flatMap((r) => r.parameters?.required_status_checks ?? []).map((c) => c.context),
+        ...classic?.contexts ?? [],
+        ...(classic?.checks ?? []).map((c) => c.context)
+      ];
+      const hit = names.find((n) => pattern.test(n));
+      if (hit) return PASS2(`${slug} ${branch} requires "${hit}"`);
+      return FAIL(names.length ? `${slug} ${branch} requires ${names.map((n) => `"${n}"`).join(", ")}, none matching ${pattern}` : `${slug} ${branch} requires no check to merge`);
+    },
+    gh(args, label) {
+      try {
+        execFileSync2("gh", args, { stdio: ["ignore", "pipe", "pipe"], timeout: 2e4 });
+        return PASS2(label);
+      } catch (e) {
+        const s = said(e);
+        if (/could not resolve|not found|HTTP 404/i.test(s.text)) return FAIL(`not yet: ${label}`);
+        return UNKNOWN(`could not ask GitHub (${s.code === "ENOENT" ? "gh is not installed" : s.text.split("\n")[0] || s.message})`);
+      }
+    },
+    /** How many of `files` pass `test`: all is a pass, some is a part. */
+    share(files, test, label) {
+      if (!files.length) return FAIL(`no files to check for: ${label}`);
+      const ok = files.filter(test).length;
+      const detail = `${ok} of ${files.length}: ${label}`;
+      return ok === files.length ? PASS2(detail) : ok ? PART(detail) : FAIL(detail);
+    }
+  };
+}
+var STATUS = { done: "\u2705", started: "\u{1F6A7}", none: "\u2B1C", unknown: "\u2754" };
+function statusOf(checks) {
+  const n = (r) => checks.filter((c) => c.result === r).length;
+  const pass = n("pass"), part = n("part"), fail = n("fail"), unknown = n("unknown");
+  if (!checks.length) return "unknown";
+  if (pass === checks.length) return "done";
+  if (pass + part > 0) return fail === 0 && unknown > 0 ? "unknown" : "started";
+  return fail > 0 ? "none" : "unknown";
+}
+async function runRepo(ROOT, app, h) {
+  const checksFile = join6(ROOT, app, "scripts", "gates-checks.mjs");
+  const define = (await import(pathToFileURL5(checksFile).href)).default;
+  const spec = define(h);
+  const git = (...a) => {
+    try {
+      return execFileSync2("git", a, { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  const rows = [];
+  for (const t of spec.tickets) {
+    const checks = [];
+    for (const c of t.checks ?? []) {
+      if (c.aggregate) continue;
+      let r;
+      try {
+        r = await c.run();
+      } catch (e) {
+        r = UNKNOWN(`the check threw: ${said(e).message}`);
+      }
+      checks.push({ repo: spec.repo, what: c.what, ...r });
+    }
+    rows.push({ ref: t.ref, title: t.title, owner: t.owner, checks });
+  }
+  return { spec, report: { schema: 1, repo: spec.repo, branch: git("rev-parse", "--abbrev-ref", "HEAD"), commit: git("rev-parse", "--short", "HEAD"), engine: ENGINE, rows } };
+}
+function runSibling(dir, app, shown) {
+  const copy = join6(dir, "scripts", "gates-status.mjs");
+  const installed = createRequire5(join6(dir, app, "package.json"));
+  let script = copy;
+  const args = ["--json"];
+  if (!existsSync5(copy)) {
+    try {
+      script = join6(installed.resolve("@estiva-app/ui/package.json"), "..", "dist", "gates", "cli.js");
+      args.unshift("status");
+      if (app !== ".") args.push("--app", app);
+    } catch {
+      return { error: `${shown} has neither its own gates-status.mjs nor @estiva-app/ui installed${app === "." ? "" : ` in ${app}`}` };
+    }
+    if (!existsSync5(script)) return { error: `${shown} has an @estiva-app/ui with no gates engine: install 0.21.0 or later` };
+  }
+  try {
+    const out = execFileSync2(process.execPath, [script, ...args], { cwd: dir, stdio: ["ignore", "pipe", "pipe"], timeout: 3e5, maxBuffer: 16 * 1024 * 1024 });
+    return { report: JSON.parse(out.toString()) };
+  } catch (e) {
+    const err = e;
+    return { error: `its gates:status failed: ${String(err.stderr ?? err.message).split("\n").filter(Boolean).slice(-1)[0]}` };
+  }
+}
+function behindMain(dir) {
+  const git = (...a) => {
+    try {
+      return execFileSync2("git", a, { cwd: dir, stdio: ["ignore", "pipe", "ignore"], timeout: 3e4 }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  if (git("rev-parse", "--is-inside-work-tree") !== "true") return "";
+  const fetched = git("fetch", "-q", "origin") !== null;
+  const main = (git("symbolic-ref", "--short", "refs/remotes/origin/HEAD") ?? "origin/main").trim();
+  const count = Number(git("rev-list", "--count", `HEAD..${main}`));
+  const stale = fetched ? "" : " (could not fetch: compared with the last fetch)";
+  if (!Number.isFinite(count) || count === 0) return stale ? ` \xB7${stale}` : "";
+  return ` \xB7 \u26A0\uFE0F ${count} commit${count === 1 ? "" : "s"} behind ${main}${stale}: pull, or this reads old code`;
+}
+function pad(s, n) {
+  const len = [...s].length;
+  return len >= n ? s : s + " ".repeat(n - len);
+}
+function printRows(rows, { showOwner, detail }) {
+  const lines = [];
+  const width = Math.max(...rows.map((r) => [...r.title ?? ""].length));
+  for (const r of rows) {
+    const pass = r.checks.filter((c) => c.result === "pass").length;
+    const count = r.checks.length ? `${pass} of ${r.checks.length}` : "no checks here";
+    lines.push(`${STATUS[r.status ?? "unknown"]}  ${pad(r.ref, 7)} ${pad(r.title ?? "", width)}  ${showOwner ? pad(r.ownerRepo ?? "", 10) : ""}${count}`);
+    if (detail || r.status === "started" || r.status === "unknown") {
+      for (const c of r.checks) {
+        const mark = { pass: "\u2713", part: "\xBD", fail: "\u2717", unknown: "?" }[c.result];
+        lines.push(`        ${mark} ${showOwner ? `${pad(c.repo, 10)} ` : ""}${c.what} \u2014 ${c.detail}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function summary(rows) {
+  const n = (s) => rows.filter((r) => r.status === s).length;
+  return `${STATUS.done} ${n("done")} done \xB7 ${STATUS.started} ${n("started")} started \xB7 ${STATUS.none} ${n("none")} not started \xB7 ${STATUS.unknown} ${n("unknown")} could not check`;
+}
+async function catalogueLines(appDir) {
+  try {
+    const { buildAppRegistry } = await import("../registry/index.js");
+    const entries = buildAppRegistry({ root: appDir }).entries;
+    const unused = entries.filter((e) => e.app?.class === "unused");
+    const oneOffs = entries.filter((e) => e.app?.class === "one-off");
+    const unlinked = oneOffs.filter((e) => !e.storyId && !e.docsId);
+    return [
+      `Unused parts: ${unused.length}${unused.length ? ` \xB7 Katerina rules on each: ${unused.map((e) => `${e.name} (${e.sourceFile})`).join(", ")}` : ""}`,
+      `Storybook links: every reusable part has one (estiva-ui check holds it) \xB7 one-offs with none: ${unlinked.length} of ${oneOffs.length}, which need none`
+    ];
+  } catch (error) {
+    return [`Catalogue: could not be built here: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`];
+  }
+}
+async function runStatus({ root = process.cwd(), app = ".", json = false, detail = false, escapes = false } = {}) {
+  const ROOT = resolve2(root);
+  const h = helpers(ROOT);
+  const shown = (dir) => (relative5(ROOT, dir) || dir).replace(/\\/g, "/");
+  const { spec, report } = await runRepo(ROOT, app, h);
+  if (json) return JSON.stringify(report);
+  const out = [];
+  out.push("UI Guardrails \xB7 gates:status", "Read from the code. Nothing here is a hand-ticked list.", "");
+  out.push(`${pad(spec.repo, 10)} ${report.branch} @ ${report.commit}${behindMain(ROOT)}`);
+  out.push("", ...escapeLines(listEscapes(join6(ROOT, app)), { all: escapes }));
+  if (!spec.all) {
+    out.push("", ...await catalogueLines(join6(ROOT, app)));
+    const own = report.rows.filter((r) => r.owner).map((r) => ({ ...r, ownerRepo: spec.repo, status: statusOf(r.checks) }));
+    const parts = report.rows.filter((r) => !r.owner).map((r) => ({ ...r, ownerRepo: "", status: statusOf(r.checks) }));
+    out.push("", `Tickets ${spec.repo} owns (${own.length}):`, printRows(own, { showOwner: false, detail }));
+    out.push("", `Parts of tickets another repo owns, checked here (${parts.length}):`, printRows(parts, { showOwner: false, detail }));
+    out.push("", "For every ticket across the repos, run npm run gates:status in estiva-ui.");
+    return out.join("\n");
+  }
+  const reports = [report];
+  const found = [];
+  for (const s of spec.siblings ?? []) {
+    const dir = resolve2(ROOT, process.env[s.env] ?? s.path);
+    if (!existsSync5(join6(dir, "package.json"))) {
+      found.push({ name: s.name, note: `not found at ${shown(dir)} (set ${s.env} to point at it)`, missing: true });
+      continue;
+    }
+    const r = runSibling(dir, s.app ?? ".", shown(dir));
+    if (!r.report) {
+      found.push({ name: s.name, note: r.error ?? "no report", missing: true });
+      continue;
+    }
+    const copy = r.report.engine !== ENGINE ? r.report.engine.startsWith("@estiva-app/ui@") ? ` \xB7 on ${r.report.engine}'s engine` : " \xB7 runs its own copy of the status engine; UIG-32 moves it onto the package" : "";
+    found.push({ name: s.name, note: `${r.report.branch} @ ${r.report.commit}, found at ${shown(dir)}${copy}${behindMain(dir)}` });
+    reports.push(r.report);
+  }
+  for (const f of found) out.push(`${pad(f.name, 10)} ${f.note}`);
+  const problems = [];
+  const known = new Set(spec.all.map((t) => t.ref));
+  for (const rep of reports) {
+    for (const r of rep.rows.filter((r2) => !known.has(r2.ref))) problems.push(`${rep.repo} reports ${r.ref}, which is not one of the tickets`);
+  }
+  const rows = spec.all.map((t) => {
+    const pieces = reports.flatMap((rep) => rep.rows.filter((r) => r.ref === t.ref).map((r) => ({ rep, r })));
+    const claims = pieces.filter((p) => p.r.owner).map((p) => p.rep.repo);
+    const ownerMissing = found.some((f) => f.name === t.owner && f.missing);
+    if (!ownerMissing && (claims.length !== 1 || claims[0] !== t.owner)) {
+      problems.push(`${t.ref}: should be owned by ${t.owner}, is claimed by ${claims.join(" and ") || "no repo"}`);
+    }
+    for (const p of pieces.filter((p2) => !p2.r.owner && !(t.parts ?? []).includes(p2.rep.repo))) {
+      problems.push(`${t.ref}: ${p.rep.repo} checks a part of it, but the ticket list does not name ${p.rep.repo}`);
+    }
+    const checks = pieces.flatMap((p) => p.r.checks);
+    for (const f of found.filter((f2) => f2.missing)) {
+      if ((t.parts ?? []).includes(f.name) || t.owner === f.name) checks.push({ repo: f.name, what: `${f.name}'s part`, result: "unknown", detail: f.note });
+    }
+    return { ref: t.ref, title: t.title, ownerRepo: t.owner, checks, aggregate: t.aggregate };
+  });
+  for (const row of rows) row.status = statusOf(row.checks);
+  for (const row of rows.filter((r) => r.aggregate)) {
+    const others = rows.filter((r) => r !== row);
+    const done = others.filter((r) => r.status === "done").length;
+    row.checks.push({ repo: "all", what: "every other ticket is done", ...done === others.length ? PASS2(`${done} of ${others.length} done`) : FAIL(`${done} of ${others.length} done`) });
+    row.status = statusOf(row.checks);
+  }
+  out.push("", printRows(rows, { showOwner: true, detail }), "", summary(rows));
+  const owners = Object.entries(rows.reduce((a, r) => ({ ...a, [r.ownerRepo ?? ""]: (a[r.ownerRepo ?? ""] ?? 0) + 1 }), {})).map(([k, v]) => `${k} ${v}`).join(", ");
+  out.push(`${rows.length} tickets. Owned by ${owners}.`);
+  const unchecked = found.filter((f) => f.missing && spec.all.some((t) => t.owner === f.name)).map((f) => f.name);
+  if (problems.length) out.push(`\u26A0\uFE0F Ownership does not add up:
+  ${problems.join("\n  ")}`);
+  else if (unchecked.length) out.push(`\u2754 Ownership not fully checked: ${unchecked.join(" and ")} could not be read.`);
+  else out.push("\u2705 Each ticket is owned by exactly one repo, and every repo agrees.");
+  if (!detail) out.push("Add -- --detail to see every check.");
+  return out.join("\n");
+}
+
+export {
+  tokenStylePlugin,
+  TOKEN_LINT_IGNORES,
+  KNOWN_PLUGINS,
+  tokenLint,
+  tokenValues,
+  tokenConfig,
+  countCommitted,
+  hookRuns,
+  skippedFolders,
+  skipsListed,
+  runCi,
+  writeGateCount,
+  runHook,
+  nameEscapes,
+  REVIEW_AFTER_DAYS,
+  listEscapes,
+  escapeLines,
+  ENGINE,
+  helpers,
+  runStatus
+};
+//# sourceMappingURL=chunk-SYVKGOWM.js.map